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We show that monogamy of Bell's inequality violations, which is strictly weaker condition than 
no-signaling is enough to prove security of quantum key distribution. We derive our results for a 
whole class of monogamy constraints and generalize our results to any theory that communicating 
parties may have access to. We also present some new qualitative results concerning the security of 
existing quantum key distribution protocols. 



Quantum cryptography [I], or more precisely Quan- 
tum Key Distribution (QKD) is the first application of 
quantum information theory that has entered the com- 
mercial market. It's success stems from the fact that 
the safety of the key distribution protocol is based only 
on the laws of quantum mechanics, contrary to classical 
public key protocols which are secure only if certain task 
is complex enough for eavesdropper to solve. Though 
the laws of quantum mechanics have never been demon- 
strated to give incorrect predictions, physicists are con- 
stantly searching for more general theories, that could in 
principle counter these laws. In such theories quantum 
cryptography would no longer be secure unless the ex- 
act properties of quantum mechanics that warrant that 
security are also present in "post-quantum" world. One 
good candidate for such property is no-signaling princi- 
ple. Since it appears not only in quantum mechanics but 
also in general relativity it is likely that in the future 
unification of these theories it will also hold. Indeed, it 
has been shown that no-signaling principle is sufficient 
for the safety of quantum key distribution [2 J . That re- 
sult significantly strengthens the QKD since, though it 
uses only the resources available in quantum theory it is 
safe in a whole family of theories that include but are not 
limited to quantum mechanics. In this paper we address 
the question, whether it is possible to find even weaker 
principle, which would lead to defining even larger group 
of theories for which quantum protocols remain secure. 
We show that monogamy of Bell's inequality violations, 
which is strictly weaker condition than no-signaling is 
enough to prove the security of quantum key distribu- 
tion. 

Monogamy relations - Let us define (3{X ,y) to be the 
left hand side of CHSH [3] inequality defined for parties 
X and y 

P{X,y)^- A Y,P{X®Y = xy\x,y)<^ (1) 

where X, Y € {0,1} are the outcomes and x, y £ 
{0,1} are the settings of parties X and y respectively. 
Throughout the whole paper we adopt notation in, which 
parties are denoted by "mathcal" letters, their settings 
by lowercase italic and outcomes by uppercase italic let- 



ters. One way to understand (|T|) is to consider a game 
where two separated parties are being given by referees 
randomly chosen numbers - the settings x, y. Their goal 
is to return the outcomes X, Y that with probability as 
high as possible satisfy X © Y — xy. CHSH inequality 
states that there is no classical procedure that would al- 
low them to have the success probability greater than |. 
On the other hand with quantum resources it is possible 
to have this probability as high as Tsirelson bound [4]: 

| ^1+ -^j . This particular approach to CHSH inequality 

stresses the fact that the outcome of each of the parties 
can be the output of any procedure used by that party, as 
long as it does not violate any of the assumptions of the 
CHSH game. This will become very useful in the proof 
of our main result. 

It has been shown [5] (see also [B]) that in any no- 
signaling theory, the following inequality must be satis- 
fied 

/3(A,S)+p(A,B)<^ (2) 

We will refer to it as NS-monogamy. It is is weaker than 
no-signaling principle since NS-monogamy holds in any 
NS theory and the converse is not true. To see this let 
us imagine a theory that allows Alice and Bob to signal 
only if they arc not correlated with any third party. That 
means (3(A, £) = |, which is enough for (|2l to hold. 

Quantum mechanics satisfies not only (I2j) but also a 
stronger relation 

P 2 (A,£) + P 2 (A,B)< \ (3) 

which has been proven in |S]. We will refer to it as QM- 
monogamy. The difference between ([3| and the form 
given in [5] follows from the fact that here we use CHSH 
inequality written in the terms of probabilities, while in 
|8J it is written in the terms of correlation functions. 

In order to be able to make more general statements we 
will express these (and any other) monogamy relations in 
a more homogenous form 

0(A,S)<fF(J3(A,B)) (4) 



2 



where is the function that describes the monogamy 
of the theory T. f^ 1 : [i, l] — > [0, 1] can be any non- 
increasing function. The domain of the function is cho- 
sen to be [|, l] since the form of CHSH inequality |lj 
has algebraic bound equal to 1 and the value of \ corre- 
sponds to probability distribution describing white noise. 
We do not have to consider the behavior of below 1 
since every monogamy relation should also has the prop- 
erty that f^((3(A,B)) = f^(l-P(A,B)) because if Bob 
always flips his outcome the value of f3(A, B) changes to 
f3'(A, B) = 1 — (3(A, B). This cannot have any influence 
on (3(A, £). Therefore we can limit ourselves to the study 
of the monogamy for f3(A, B) > \. The above examples 
expressed in this way become 



(3(A,£) < f^ s WA,B)) = --{3(A,B).(5) 



(3(A,S)<fM M ((3(A,B)) 



i-(2/3(AS)- 1) 2 + 1 



(6) 



Now we are ready to present our main result, which 
states that (|5| is sufficient condition for the security of 
quantum key distribution protocols against individual at- 
tacks. 

Main result - We will consider the following QKD pro- 
tocol used by Alice and Bob: They share a large number 
of copies of a state, which they hope is close to singlet. 
For each copy they randomly choose one of the measure- 
ments that are optimal for the violation of CHSH in- 
equality and write down the outcomes. Later they choose 
randomly a part of the runs and announce all the data 
corresponding to them to estimate (3(A,B). In the rest 
of the cases only Alice announces her choice of the basis. 
Her outcome is going to be the key. It has been proven [7] 
that they will be able to establish secure communication 
if 



I(A:B) >I(A:£). 



(7) 



Since we are interested only in individual attacks and 
outcome of Alice is binary, the above condition simplifies 
to 



Pr > Pr 



(8) 



where Pb and Pe are probabilities that Bob and Eve 
respectively guess the bit of Alice after the announcement 
of her choice of measurement basis. We will now show 
that if Eve is in the possession of a procedure that gives 
her high Pe, she could use the same procedure to play 
the CHSH game better than NS-monogamy allows. 

Since the outcome of Alice A equals A = B ab with 
the probability f3(A, B), Bob, who knows a, b and B can 
guess that A — B®ab and be right with the probability 



P B =/3(A,B). 



(9) 



Now, let us assume that Eve has a procedure that takes 
as an input the setting a of Alice and generates G as an 
output. The performance of this procedure is defined 
by the set of four probabilities P^ which describe the 
probability that G equals the outcome of Alice if her 
setting was j and Eve inputs i to her procedure. For the 
reasons that will soon become clear we have to consider 
also the cases in which Eve inputs a value different than 
the setting of Alice, but when Eve is eavesdropping that 
will never happen. Her success probability is then 



Pr 



Pn, 



Pi 



- < max{P 00 ,Pii}. 



(10) 



We will consider two possible cases. First: Poo > Pn 
and Pe < Poo- Let us see what value of f3(A, £) can 
Eve achieve with a strategy that involves the use of her 
procedure. Since in the CHSH game she does not know 
the setting of Alice, she will always input to her pro- 
cedure. If she returns as her outcome E = G then the 
probabilities that appear in CHSH are equal 
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That leads to 

(3(A,£) 



:Po, 



1 1 

- > -Pe 
4 " 2 E 



(11) 



(12) 



In the second case: Poo < Pn and Pe < Pn- Now 
Eve adapts a different strategy. She will always input 1 
and return E — G e as her outcome. The probabilities 
that appear in CHSH are now 



P(A ® E = 0\a = 0, e = 0) = P 10 
P(A®E = 0\a= l,e = 0) = P u 
P{A ® E = 0|a = Q, e = 1) = 1 - Pi 
P(A®E = l\a=l,e=l) = P u 



That leads to 

(3(A,£) 



-Pn 



1 1 

- > -Pe 
4 2 



Therefore, for both cases, we have 

\p E + \<(3{A,£) 
We now use NS-monogamy (|5| and ^ to get 



1 



Pe + 7 < m(PB) 



(13) 
(14) 

(15) 

(16) 
Pb, 



If we write f^ s in the explicit form /^(Pb) = 
we get our main result that ( 16 1 implies (|8| as long as 

| is less 



Pb = Pns{A,B) > |. It is worth noticing that 
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than Tsirelson bound, so the correlations between A and 
B required for the security based only on monogamy are 
within reach of quantum mechanics. 

Generalization to other monogamies - Note that the 
derivation of our main result does not depend on the ex- 
plicit form of fjf s , which is only used later to establish 
the minimal value of f3(A, B) required for security. Since 
nowhere in the paper we assume no-signaling, we do not 
have to limit ourselves to the monogamy constraint de- 
rived from that principle. If instead of NS-monogamy 
([5]) we would assume QM-monogam y (|6| (which can also 
hold in signaling theories), instead (|16[) we would get 



qm( p b), 



(17) 



which leads to weaker requirement: /3qm(A,B) > i + 
1 

Vw' 

In general, for any theory T which has T-monogamy 
defined by Q the following condition holds 



1 



1 



Pe + -<W(Pb) 



(18) 



It will be possible to construct a safe cryptographic pro- 
tocol for Alice and Bob who have access only to quantum 
resources as long as the highest value of Pb achievable by 



quantum mechanics causes ( 18 1 to bound Pe to values 



lower than Pb- Rewriting (15 1 as 



Pe < 2/3(Af) 



(19) 



and keeping in mind that Pb = /3(A, B) we find that 
the condition ([8| will be satisfied if the T-monogamy can 
imply 



0(A,B)>2/3{A,£)-~ 



(20) 



NS-monogamy 
QM-monogamy 
1 . 1 -monogamy 
Sufficient condition 




FIG. 1: Monogamy relations for different theories are plotted. 
The sufficient condition for the security of the key distribu- 
tion protocol ( |21[ | is described by the line that passes through 

P = (K 1 + 75)1 K 1 + 573))- The intersection of this line 
with monogamy relation for any specific theory T gives the 
critical value of /3t(A, B) above which Alice and Bob can have 
secure communication. More explicitly, if A and B estimate 
their f3{A,B) to be greater than /3t{A,B), they can have se- 
cure communication against individual attacks of the eaves- 
dropper who has access to the resources of theory T. Point P 
has its horizontal coordinate equal to the Tsirelson bound, so 
for any theory T that intersects the sufficient condition line 
before P, it is possible for A and B to have a quantum protocol 
secure against attacks from T regime. Note that intersection 
of 1.1-monogamy with sufficient condition line is slightly be- 
fore P. Therefore, quantum mechanics allows QKD secure 
against attacks by eavesdroppers from all three theories. 



or in other words 



(21) 



Which, if Alice and Bob are able to reach the Tsirelson 
bound, becomes 



(22) 




The critical value of (3(A,B) for theory with 1.1- 
monogamy is 0.8530 which, though quite high, is still 
0.07% lower than Tsirelson bound. 

All three discussed monogamies along with the suffi- 
cient condition (21) are presented in fig. [I] 

Our result can be easily generalized to the the case 
where Alice and Bob have access to the resources of the- 
ory T, while the eavesdropper has access to the resources 
of T'. If T allows for (3 T (A, B) and T has T '-monogamy 



Inequality ( 21 1 is the sufficient condition on T-monogamy then ( 22 ) becomes 



to be able to warrant the safety of quantum key distri- 
bution protocol. 

For example, let us consider a 1.1-monogamy which is 
weaker than that of any no-signaling theory It is defined 

by 



< -P T (A,B) 



(24) 



/ 1 M 1 (/3) = i((l-(2^-l) 1 ' 1 )"+l) 



(23) 



Discussion - In the proofs of security that are based ei- 
ther on laws of quantum mechanics or no-signaling princi- 
ple there appears a critical value of j3(A, B) . If Alice and 
Bob estimate their correlations to be below that value 
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they cannot assume security. If they are above, then 
they are secure and the actual value of f3 cr i t (A,B) im- 
plies only the key rate. On the other hand, if we assume 
only monogamy than the higher f3(A, B) the larger the 
number of theories in which A and B are secure. That 
is an interesting corollary as it shows that cryptographic 
systems that use Bell inequalities to warrant the security 
not only get higher key rates as the violation of Bell's in- 
equality raises but also gain more qualitative security as 
the number of theories against attacks from which they 
are protected raises too. 

We have shown that it is possible to base the security 
of quantum key distribution only on monogamy relations 
for violations of Bell's inequality. That is significantly 
weaker assumption than the best previously known - no- 
signaling principle. Moreover, our proof does not depend 
on the specific type of the monogamy relation, but on its 



generalized our results to give predictions for any theory 
that the communicating parties may have access to. 

In the case of security based on no-signaling, the proofs 
went a long way from partial version presented in [5] 
to universally-composable [9] shown in [TU]. We express 
hope that our paper will begin the similar path for secu- 
rity based on monogamy, which would strengthen quan- 
tum cryptography even further. 
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